CVE-2026-22699

RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 PKE decryption path where an invalid elliptic-curve point (C1) is decoded and the resulting value is unwrapped without checking. Specifically, AffinePoint::from_encoded_point(&encoded_c1) may return a None/CtOption::None when the supplied coordinates are syntactically valid but do not lie on the SM2 curve. The calling code previously used .unwrap(), causing a panic when presented with such input. This issue has been patched via commit 085b7be.

• CWE-20

• https://github.com/RustCrypto/elliptic-curves/commit/085b7bee647029bd189e1375203418205006bcabPatch
• https://github.com/RustCrypto/elliptic-curves/pull/1602Issue Tracking, Patch
• https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-78p6-6878-8mj6Exploit, Vendor Advisory
• https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-78p6-6878-8mj6Exploit, Vendor Advisory

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22693HarfBuzz is a text shaping engine. Prior to version 12.3.0, …5.3
• CVE-2026-22694AliasVault is a privacy-first password manager with built-in…6.1
• CVE-2026-22695LIBPNG is a reference library for use in applications that r…7.1
• CVE-2026-22696dcap-qvl implements the quote verification logic for DCAP (D…9.3
• CVE-2026-22697CryptoLib provides a software-only solution using the CCSDS …7.5
• CVE-2026-22698RustCrypto: Elliptic Curves is general purpose Elliptic Curv…7.5
• CVE-2026-22700RustCrypto: Elliptic Curves is general purpose Elliptic Curv…7.5
• CVE-2026-22701filelock is a platform-independent file lock for Python. Pri…5.3
• CVE-2026-22702virtualenv is a tool for creating isolated virtual python en…4.5
• CVE-2026-22703Cosign provides code signing and transparency for containers…5.5
• CVE-2026-22704HAX CMS helps manage microsite universe with PHP or NodeJs b…5.4
• CVE-2026-22705RustCrypto: Signatures offers support for digital signatures…6.4